@bongos/core 1.21.35 → 1.21.36

package/modules/lifecycle/routes/done-when.js

@@ -25,6 +25,7 @@ const goalEdits = require('../goal-edits.js');
 const uatDb = require('../criterion-uat-db.js');
 const { isReservedCriterionSlug } = require('../criterion-ref.js');
 const { validateOrRespond, parseId, asyncHandler, LIMITS } = api;
+const log = api.logger('lifecycle');
 
 // authorizeCriterionCreate — the ORDERED, FAIL-CLOSED decision for a non-Archon
 // POST /versions/:id/done-when (ADR 0154). PURE + exported so every rejection is
@@ -80,6 +81,24 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
   return { ok: true };
 }
 
+// Close a criterion WITHOUT a UAT, on a stated reason: the override row and the
+// flip in ONE transaction (an override row with no flip behind it would claim a
+// close that never happened), then the goal achieves if that was its last
+// criterion (a criterion with no goal completes none). Shared by POST
+// /done-when/:id/satisfy and a passed Review matter (task 1004561,
+// ../matter-acts.js) so the two can never differ.
+async function satisfyByOverride({ criterionId, signerId, reason, taskId = null }) {
+  const updated = await api.withTx(async (client) => {
+    await uatDb.recordOverride(client, { criterionId, signerId, reason });
+    return doneWhen.markCriterion(criterionId, taskId, { client });
+  }, { pool: api.pool });
+  let goalResult = { achieved: false, goal: null };
+  if (updated?.goal_id != null) {
+    goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
+  }
+  return { updated, goalResult };
+}
+
 module.exports = function buildDoneWhenRouter() {
   const router = express.Router();
 
@@ -248,18 +267,7 @@ module.exports = function buildDoneWhenRouter() {
       });
     }
     const taskId = req.body?.satisfied_by_task_id ?? null;
-    // ONE transaction: an override row with no flip behind it would claim a
-    // close that never happened, so the two commit together or not at all.
-    const updated = await api.withTx(async (client) => {
-      await uatDb.recordOverride(client, { criterionId: id, signerId: req.builder.id, reason });
-      return doneWhen.markCriterion(id, taskId, { client });
-    }, { pool: api.pool });
-    // Auto-achieve: confirming a goal's last criterion flips it open→achieved.
-    // A criterion with no goal (goal_id NULL) completes no goal.
-    let goalResult = { achieved: false, goal: null };
-    if (updated?.goal_id != null) {
-      goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
-    }
+    const { updated, goalResult } = await satisfyByOverride({ criterionId: id, signerId: req.builder.id, reason, taskId });
     // BV1.R08 (task 1003595): when the goal did NOT flip because it still holds
     // unfinished work, say so. Confirming the last criterion and getting a bare
     // `goal_achieved: false` back reads as a bug to the agent that just did it —
@@ -466,12 +474,17 @@ module.exports = function buildDoneWhenRouter() {
 
   // Auth: flip a criterion back to unsatisfied (rare; for corrections).
   // rank: archon — un-flip a criterion; same gate as satisfy.
+  // An optional `reason` (the Review desk's one-tap chip, task 1004561) is
+  // logged beside who undid it; the flip itself is unchanged.
   router.post('/done-when/:criterionId/unsatisfy', auth.requireBuilder, auth.requirePermission('criterion.unsatisfy'), asyncHandler('POST /done-when/:criterionId/unsatisfy', async (req, res) => {
+    if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 200 } })) return;
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;
     const existing = await doneWhen.getCriterion(id);
     if (!existing) return res.fail('criterion_not_found', 404);
     const updated = await doneWhen.unmarkCriterion(id);
+    const why = typeof req.body?.reason === 'string' && req.body.reason.trim() ? `: ${req.body.reason.trim()}` : '';
+    log.info(`[gds] criterion ${id} sign-off UNDONE by builder ${req.builder.id}${why}`);
     res.json({ criterion: updated });
   }, { errorCode: 'unsatisfy_failed' }));
 
@@ -482,3 +495,4 @@ module.exports = function buildDoneWhenRouter() {
 // tests/criterion_authoring_gate.mjs (DB-free), the authorizeGoalTaskCreate
 // precedent in routes/goals.js.
 module.exports.authorizeCriterionCreate = authorizeCriterionCreate;
+module.exports.satisfyByOverride = satisfyByOverride;

package/modules/lifecycle/routes/gate-approvals.js

@@ -141,6 +141,75 @@ function contributeGateApprovalsToDocket() {
   });
 }
 
+// The approval itself, shared by the route above and a passed Release matter
+// (task 1004561, ../matter-acts.js) so the two can never differ. Returns
+// { ok: true, body } or { ok: false, code, status, message }; throws on an
+// unexpected failure (the caller says it). `login` is who approved, as the
+// status description names it.
+async function approveGatePr({ number, login }) {
+  if (!githubPush.isConfigured()) {
+    return { ok: false, code: 'publish_unconfigured', status: 503, message: 'No server GitHub credential configured — cannot approve.' };
+  }
+  // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
+  // so a later commit's head carries no approval — red-team #2b protection).
+  const prs = await githubPush.listOpenPullRequests({});
+  const pr = prs.find((p) => p.number === number);
+  if (!pr) return { ok: false, code: 'pr_not_open', status: 404, message: `No open PR #${number}.` };
+  if (!pr.head_sha) return { ok: false, code: 'no_head_sha', status: 409, message: 'Could not resolve the PR head commit.' };
+
+  const gate = findCheck(pr, 'gate-review');
+  if (gate && isSuccess(gate)) {
+    return { ok: true, body: { ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' } };
+  }
+
+  // 1. Set the trustless owner-approval status on the head sha.
+  const set = await githubPush.setGateOwnerApproved({ sha: pr.head_sha, login, targetUrl: pr.url });
+  if (!set) {
+    // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see the route's catch).
+    return { ok: false, code: 'status_set_failed', status: 500, message: 'Could not set the gate-owner-approved status.' };
+  }
+
+  // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
+  //    required check re-evaluates the new approval; re-arm auto-merge.
+  //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
+  //    1004323): clearing the gate check is the owner's act on the PR, and
+  //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
+  //    read that throws answers held, and an ordinary confirmed task left
+  //    un-armed still lands through the publish reconciler's sweep.
+  const prTask = taskIdFromPr(pr);
+  const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
+  let recheck = { reopened: false, auto_merge: false };
+  try {
+    recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
+  } catch (e) {
+    // The status IS set; if the re-trigger failed, the next push or a manual
+    // re-run still clears it, and the publish reconciler sweep merges once green.
+    console.error('[gds] gate-approval recheck failed', e);
+    return {
+      ok: true,
+      body: {
+        ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
+        message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
+      },
+    };
+  }
+
+  return {
+    ok: true,
+    body: {
+      ok: true,
+      pr: number,
+      head_sha: pr.head_sha,
+      status_set: true,
+      recheck,
+      held_for_artist: held,
+      message: held
+        ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
+        : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
+    },
+  };
+}
+
 module.exports = function buildGateApprovalsRouter() {
   contributeGateApprovalsToDocket();
   const router = express.Router();
@@ -189,66 +258,10 @@ module.exports = function buildGateApprovalsRouter() {
   router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), async (req, res) => {
     const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
     if (number == null) return;
-    if (!githubPush.isConfigured()) {
-      return res.fail('publish_unconfigured', { status: 503, message: 'No server GitHub credential configured — cannot approve.' });
-    }
     try {
-      // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
-      // so a later commit's head carries no approval — red-team #2b protection).
-      const prs = await githubPush.listOpenPullRequests({});
-      const pr = prs.find((p) => p.number === number);
-      if (!pr) return res.fail('pr_not_open', { status: 404, message: `No open PR #${number}.` });
-      if (!pr.head_sha) return res.fail('no_head_sha', { status: 409, message: 'Could not resolve the PR head commit.' });
-
-      const gate = findCheck(pr, 'gate-review');
-      if (gate && isSuccess(gate)) {
-        return res.json({ ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' });
-      }
-
-      // 1. Set the trustless owner-approval status on the head sha.
-      const set = await githubPush.setGateOwnerApproved({
-        sha: pr.head_sha,
-        login: req.builder.github_login,
-        targetUrl: pr.url,
-      });
-      if (!set) {
-        // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see catch).
-        return res.fail('status_set_failed', { status: 500, message: 'Could not set the gate-owner-approved status.' });
-      }
-
-      // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
-      //    required check re-evaluates the new approval; re-arm auto-merge.
-      //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
-      //    1004323): clearing the gate check is the owner's act on the PR, and
-      //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
-      //    read that throws answers held, and an ordinary confirmed task left
-      //    un-armed still lands through the publish reconciler's sweep.
-      const prTask = taskIdFromPr(pr);
-      const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
-      let recheck = { reopened: false, auto_merge: false };
-      try {
-        recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
-      } catch (e) {
-        // The status IS set; if the re-trigger failed, the next push or a manual
-        // re-run still clears it, and the publish reconciler sweep merges once green.
-        console.error('[gds] gate-approval recheck failed', e);
-        return res.json({
-          ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
-          message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
-        });
-      }
-
-      res.json({
-        ok: true,
-        pr: number,
-        head_sha: pr.head_sha,
-        status_set: true,
-        recheck,
-        held_for_artist: held,
-        message: held
-          ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
-          : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
-      });
+      const out = await approveGatePr({ number, login: req.builder.github_login });
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      res.json(out.body);
     } catch (err) {
       console.error('[gds] POST /gate-approvals/:pr/approve', err);
       // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
@@ -261,3 +274,5 @@ module.exports = function buildGateApprovalsRouter() {
 
   return router;
 };
+
+module.exports.approveGatePr = approveGatePr;

package/modules/lifecycle/routes/lifecycle.js

@@ -139,6 +139,8 @@ function registerSeams() {
 module.exports = function buildLifecycleRouter() {
   registerSeams();
   governorDocket.contributeLifecycleToDocket();
+  // what a passed Review or Release matter carries out (task 1004561)
+  require('../matter-acts').contributeLifecycleMatterActs();
   // No HTTP surface — the lifecycle capability is a pure kernel port. The empty
   // router is only the loader's contributes.routes mount vehicle; returning a
   // valid express.Router() keeps mountModuleRoutes' `router.use(sub)` happy

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.35",
+  "version": "1.21.36",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.35",
+      "version": "1.21.36",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.35",
+  "version": "1.21.36",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8970,5 +8970,15 @@
       "id": "1004559",
       "text": "Governing now happens inside the buildings. On a floor's desk you can set a builder's tier, deactivate them, invite someone by GitHub name, give or take back a custom rank; confirm, dispute or mark fixed a security report and"
     }
+  ],
+  "1.21.36": [
+    {
+      "id": "1004561",
+      "text": "Three new governing actions, all in place inside the buildings. In Treasury you can now set each builder's monthly spending limit with one tap. In Review you can undo a sign-off with a one-tap reason. And when a council decide"
+    },
+    {
+      "id": "1004560",
+      "text": "The Planning building now has three working desks on its first floors. Priorities lists the open goals in order with a square for each promise; arrows move a goal up or down, and a save bar (with undo) sets the new order, or,"
+    }
   ]
 }

package/src/bongos/route-rank-check.js

@@ -194,6 +194,8 @@ const EXPECTED_RANKS = {
   // builder authority — rank + lifecycle status mutation
   'PATCH /builders/:id/rank': 'perm:builder.rank.set',
   'PATCH /builders/:id/status': 'perm:builder.status.set',
+  // task 1004561: the Treasury desk sets a builder's monthly limit through it
+  'PATCH /builders/:id/budget': 'perm:builder.budget.set',
   // session revocation (kill another builder's / all sessions)
   'POST /auth/revoke': 'perm:auth.session.revoke',
   'POST /auth/revoke-all': 'perm:auth.session.revoke',

package/src/bongos/routes/builders.js

@@ -205,8 +205,62 @@ function contributeBuilderDesk() {
   });
 }
 
+// The Treasury desk's budget rows (task 1004561): one row per active builder,
+// their monthly spending limit as the fact, and the limits a viewer holding
+// builder.budget.set (PATCH /builders/:id/budget's own atom) may set in one tap.
+// The chip for the limit a builder already has is left off. Pure; exported.
+const BUDGET_CHIPS = Object.freeze([25, 50, 100, 250]);
+function budgetWords(usd) {
+  return usd == null ? 'no limit' : `$${Number(usd).toLocaleString('en-US', { maximumFractionDigits: 2 })} a month`;
+}
+function budgetDeskRows(builders) {
+  return (builders || []).filter(Boolean).map((b) => {
+    const now = b.monthly_budget_usd == null ? null : Number(b.monthly_budget_usd);
+    const options = BUDGET_CHIPS.filter((n) => n !== now).map((n) => ({ key: String(n), label: `$${n} a month` }));
+    if (now !== null) options.push({ key: 'none', label: 'no limit' });
+    return {
+      id: b.id, name: b.display_name || b.github_login || `builder ${b.id}`, fact: budgetWords(now),
+      facts: b.github_login ? [`@${b.github_login}`] : [], ref: { type: 'builder_budget', id: b.id },
+      acts: [{ key: 'budget', options: options.slice(0, 5) }],
+    };
+  });
+}
+// The one write both the route and a passed Treasury matter make.
+async function setMonthlyBudget(builderId, usd) {
+  return seams.resolveOptional('reward').setBuilderMonthlyBudget(builderId, usd);
+}
+function contributeTreasury() {
+  seams.contribute('governor.docket', {
+    desk: 'treasury.budgets',
+    gate: { permission: 'builder.budget.set' },
+    // one read: the active roster and each limit together
+    read: async () => {
+      const { rows } = await pool.query(
+        `SELECT id, github_login, display_name, monthly_budget_usd
+           FROM builders
+          WHERE status = 'active'
+          ORDER BY COALESCE(display_name, github_login)`,
+      );
+      return budgetDeskRows(rows);
+    },
+  });
+  // What a passed Treasury matter carries out, when the decision table puts
+  // Treasury to a sitting: the same write as PATCH /builders/:id/budget.
+  seams.contribute('governor.matterAct', {
+    area: 'treasury',
+    type: 'set_budget',
+    act: async (action, ctx) => {
+      const updated = await setMonthlyBudget(action.builder_id, action.monthly_usd);
+      if (!updated) return { done: false, reason: 'builder_not_found' };
+      log.info(`[gds] builder ${action.builder_id} monthly budget set to ${budgetWords(action.monthly_usd)} by a passed Treasury matter (matter ${ctx && ctx.matterId})`);
+      return { done: true };
+    },
+  });
+}
+
 module.exports = function buildBuildersRouter() {
   contributeBuilderDesk();
+  contributeTreasury();
   const router = express.Router();
 
   // rank: archon — sole chokepoint that mutates builders.rank; ADR 0016 §enforcement.
@@ -361,7 +415,7 @@ module.exports = function buildBuildersRouter() {
       // setBuilderMonthlyBudget carved to modules/economy/ (BV1.R77 / ADR 0093
       // §1-2): resolve the `reward` kernel port (economy is default-on). The
       // archon rank gate on this route is unchanged.
-      const updated = await seams.resolveOptional('reward').setBuilderMonthlyBudget(targetId, budget);
+      const updated = await setMonthlyBudget(targetId, budget);
       if (!updated) return res.fail('builder_not_found', 404);
       res.json({ builder: updated });
     } catch (err) {
@@ -747,3 +801,4 @@ module.exports = function buildBuildersRouter() {
 };
 
 module.exports.builderDeskRows = builderDeskRows;
+module.exports.budgetDeskRows = budgetDeskRows;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.35'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.36'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/governor_matter_acts.mjs

@@ -0,0 +1,241 @@
+// tests/governor_matter_acts.mjs — a PASSED matter at Automation, Release,
+// Review or Treasury carries out its act (task 1004561, goal 1000125), the way
+// People already did: after the close commits, through the owning module's act,
+// which calls the same function as that building's direct route. Also the two
+// new desks' server halves (the Treasury budget rows, the Review undo rows) and
+// the budget route's permission pin. DB-free: every write is a stub.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const board = require(path.join(GOV, 'board.js'));
+const decisionBoard = require(path.join(GOV, 'decision-board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const autoActs = require(path.join(ROOT, 'modules', 'autonomy', 'matter-acts.js'));
+const autoDb = require(path.join(ROOT, 'modules', 'autonomy', 'db.js'));
+const lifeActs = require(path.join(ROOT, 'modules', 'lifecycle', 'matter-acts.js'));
+const lifeDb = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
+const doneWhen = require(path.join(ROOT, 'modules', 'lifecycle', 'done-when.js'));
+const doneWhenRoutes = require(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'done-when.js'));
+const gateRoutes = require(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'gate-approvals.js'));
+const lifeDocket = require(path.join(ROOT, 'modules', 'lifecycle', 'governor-docket.js'));
+const buildersRoute = require(path.join(ROOT, 'src', 'bongos', 'routes', 'builders.js'));
+const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+
+async function stub(obj, stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = obj[k]; obj[k] = v; }
+  try { return await fn(); } finally { for (const [k, v] of Object.entries(originals)) obj[k] = v; }
+}
+const sittingRow = (area, decided_by, rule) => ({ area, decided_by, rule, who: null, set_by_item_id: '30' });
+
+// Register every owning module's acts once, as their routers do at boot.
+autoActs.contributeAutomationMatterActs();
+lifeActs.contributeLifecycleMatterActs();
+buildersRoute();
+
+// ── the shape of each act ───────────────────────────────────────────────────
+
+test('each building\'s act is checked strictly when the matter is opened: shape, fields, nothing guessed', () => {
+  const v = decisionBoard.validateMatterAction;
+  assert.deepEqual(v('automation', { type: 'switch_on' }), { ok: true, action: { type: 'switch_on' } });
+  assert.deepEqual(v('automation', { type: 'allow_goal', goal_id: '12' }).action, { type: 'allow_goal', goal_id: 12 });
+  assert.deepEqual(v('release', { type: 'approve_gate', pr: 1500 }).action, { type: 'approve_gate', pr: 1500 });
+  assert.deepEqual(v('release', { type: 'approve_override', request_id: 4 }).action, { type: 'approve_override', request_id: 4 });
+  assert.deepEqual(v('review', { type: 'satisfy_criterion', criterion_id: 9 }).action, { type: 'satisfy_criterion', criterion_id: 9 });
+  assert.deepEqual(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: 50 }).action, { type: 'set_budget', builder_id: 7, monthly_usd: 50 });
+  assert.equal(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: null }).action.monthly_usd, null, 'null clears the limit');
+  // refusals, each named
+  assert.equal(v('rules', { type: 'switch_on' }).reason, 'action_not_supported_here');
+  assert.equal(v('planning', { type: 'switch_on' }).reason, 'action_not_supported_here');
+  assert.equal(v('automation', { type: 'satisfy_criterion', criterion_id: 9 }).reason, 'bad_action', 'an act from another building');
+  assert.equal(v('automation', { type: 'switch_on', goal_id: 3 }).reason, 'unknown_field');
+  assert.equal(v('automation', { type: 'allow_goal' }).field, 'action.goal_id');
+  assert.equal(v('automation', { type: 'allow_goal', goal_id: 0 }).reason, 'bad_action');
+  assert.equal(v('automation', { type: 'allow_goal', goal_id: true }).reason, 'bad_action');
+  assert.equal(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: -1 }).reason, 'bad_action');
+  assert.equal(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: '50' }).reason, 'bad_action');
+  assert.equal(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: 1e9 }).reason, 'bad_action');
+  assert.equal(v('review', []).reason, 'bad_action');
+  // People is unchanged
+  assert.deepEqual(v('people', { type: 'assign_rank', builder_id: '7', rank_key: 'tester' }).action, { type: 'assign_rank', builder_id: 7, rank_key: 'tester' });
+});
+
+test('every act in the table is carried out by its owning module, and only those', () => {
+  for (const [area, acts] of Object.entries(decisionBoard.MATTER_ACTIONS)) {
+    if (area === 'people') continue; // People acts inside the government module itself
+    for (const type of Object.keys(acts)) assert.ok(decisionBoard.matterActFor(area, type), `${area}.${type} has an act`);
+  }
+  assert.equal(decisionBoard.matterActFor('automation', 'satisfy_criterion'), null);
+});
+
+test('opening a matter whose act no module carries out is refused before anything is filed', async () => {
+  const never = async () => { throw new Error('must not be reached'); };
+  await stub(db, { listDecisionRules: async () => [sittingRow('automation', 'rank:council', 'majority')], createMatter: never, openBoardItem: never }, async () => {
+    await stub(api, { contributions: () => [] }, async () => {
+      const out = await board.openMatter({ area: 'automation', title: 'Switch it on', action: { type: 'switch_on' }, proposedBy: '42' });
+      assert.equal(out.reason, 'action_not_wired');
+    });
+  });
+  let made = null;
+  await stub(db, {
+    listDecisionRules: async () => [sittingRow('treasury', 'rank:council', 'majority')],
+    createMatter: async (a) => { made = a; return { id: '8', ...a }; },
+    openBoardItem: async (a) => ({ id: '40', subject_type: a.subjectType, subject_id: a.subjectId }),
+  }, async () => {
+    const out = await board.openMatter({ area: 'treasury', title: 'Ana: $50 a month', action: { type: 'set_budget', builder_id: 7, monthly_usd: 50 }, proposedBy: '42' });
+    assert.equal(out.ok, true, JSON.stringify(out));
+  });
+  assert.deepEqual(made.action, { type: 'set_budget', builder_id: 7, monthly_usd: 50 });
+});
+
+// ── a passed matter acts; a returned one never does ─────────────────────────
+
+async function closeMatter({ area, action, outcome = 'passed', extraDb = {} }) {
+  const subjectType = `${area}_matter`;
+  const votes = outcome === 'passed' ? [{ voter_id: '9', direction: 'yes' }] : [{ voter_id: '9', direction: 'no', reason_md: 'no' }];
+  const events = [];
+  return stub(api, { emitAsync: async (name, payload) => { events.push([name, payload]); } }, () => stub(db, {
+    getVotesForItem: async () => votes,
+    closeBoardItem: async ({ outcome: o, afterClose }) => {
+      assert.equal(afterClose, null, 'a matter books nothing inside the close');
+      return { id: '40', subject_type: subjectType, subject_id: '8', opened_by: '42', closed_at: 'T', outcome: o };
+    },
+    getMatter: async () => ({ id: '8', area, title: 'A matter', action, proposed_by: '42' }),
+    insertAuthorRatifyKarma: async () => { throw new Error('a matter pays nobody'); },
+    getBoardItemAuthor: async () => '42',
+    ...extraDb,
+  }, async () => {
+    const item = { id: '40', subject_type: subjectType, subject_id: '8', opened_by: '42', closed_at: null, constitution: { membership: 'rank:council', pass_rule: 'first_ratifier', rule: 'first' } };
+    return { out: await board.closeItem(item), events };
+  }));
+}
+
+test('a passed Automation matter switches the fence and allows a goal, as the proposer, through the route\'s own writes', async () => {
+  const writes = [];
+  await stub(autoDb, {
+    setFenceEnabled: async (a) => { writes.push(['fence', a]); return { enabled: a.enabled }; },
+    allowGoal: async (a) => { writes.push(['allow', a]); return { goal_id: a.goalId }; },
+  }, async () => {
+    const on = await closeMatter({ area: 'automation', action: { type: 'switch_on' } });
+    assert.equal(on.out.outcome, 'passed');
+    assert.deepEqual(on.out.acted, { area: 'automation', matter_id: '8', action: 'switch_on', done: true });
+    const passed = on.events.find(([n]) => n === 'board.matter.passed');
+    assert.equal(passed[1].acted, true);
+    await closeMatter({ area: 'automation', action: { type: 'switch_off' } });
+    await closeMatter({ area: 'automation', action: { type: 'allow_goal', goal_id: 12 } });
+  });
+  assert.deepEqual(writes.map(([k, a]) => [k, a.enabled ?? a.goalId, a.builderId]), [['fence', true, '42'], ['fence', false, '42'], ['allow', 12, '42']]);
+  assert.match(writes[0][1].reason, /passed Automation matter \(matter 8\)/);
+});
+
+test('a RETURNED matter carries out nothing', async () => {
+  let wrote = false;
+  await stub(autoDb, { setFenceEnabled: async () => { wrote = true; return {}; } }, async () => {
+    const back = await closeMatter({ area: 'automation', action: { type: 'switch_on' }, outcome: 'returned' });
+    assert.equal(back.out.outcome, 'returned');
+    assert.equal(back.out.acted, undefined);
+  });
+  assert.equal(wrote, false);
+});
+
+test('a passed Review matter signs the criterion off by override, once', async () => {
+  const signed = [];
+  await stub(doneWhenRoutes, { satisfyByOverride: async (a) => { signed.push(a); return { updated: {}, goalResult: {} }; } }, () =>
+    stub(doneWhen, { getCriterion: async (id) => ({ id, satisfied: id === 10 }) }, async () => {
+      const out = (await closeMatter({ area: 'review', action: { type: 'satisfy_criterion', criterion_id: 9 } })).out;
+      assert.equal(out.acted.done, true);
+      const again = (await closeMatter({ area: 'review', action: { type: 'satisfy_criterion', criterion_id: 10 } })).out;
+      assert.deepEqual([again.outcome, again.acted.done, again.acted.reason], ['passed', false, 'already_satisfied'], 'a refusal leaves the decision standing');
+    }));
+  assert.equal(signed.length, 1);
+  assert.equal(signed[0].criterionId, 9);
+  assert.equal(signed[0].signerId, '42');
+  assert.match(signed[0].reason, /passed Review matter/);
+});
+
+test('a passed Release matter approves an override or clears a gate; a request already decided is said, not thrown', async () => {
+  const calls = [];
+  await stub(lifeDb, {
+    decideOverrideRequest: async (a) => {
+      calls.push(['override', a]);
+      if (a.requestId === 5) throw Object.assign(new Error('closed'), { code: 'REQUEST_NOT_OPEN' });
+      return {};
+    },
+  }, () => stub(gateRoutes, { approveGatePr: async (a) => { calls.push(['gate', a]); return a.number === 2 ? { ok: false, code: 'pr_not_open' } : { ok: true, body: {} }; } }, async () => {
+    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_override', request_id: 4 } })).out.acted.done, true);
+    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_override', request_id: 5 } })).out.acted.reason, 'request_not_open');
+    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_gate', pr: 1500 } })).out.acted.done, true);
+    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_gate', pr: 2 } })).out.acted.reason, 'pr_not_open');
+  }));
+  assert.deepEqual(calls[0], ['override', { requestId: 4, archonId: '42', decision: 'approve', note: 'A passed Release matter (matter 8) decided it.' }]);
+  assert.equal(calls[2][1].number, 1500);
+});
+
+test('a passed Treasury matter sets the limit through the same write as PATCH /builders/:id/budget', async () => {
+  const set = [];
+  const reward = seams.resolveOptional('reward');
+  const fake = { setBuilderMonthlyBudget: async (id, usd) => { set.push([id, usd]); return id === 404 ? null : { id, monthly_budget_usd: usd }; } };
+  await stub(seams, { resolveOptional: (name, fb) => (name === 'reward' ? fake : (reward && fb)) }, async () => {
+    assert.equal((await closeMatter({ area: 'treasury', action: { type: 'set_budget', builder_id: 7, monthly_usd: 50 } })).out.acted.done, true);
+    assert.equal((await closeMatter({ area: 'treasury', action: { type: 'set_budget', builder_id: 404, monthly_usd: null } })).out.acted.reason, 'builder_not_found');
+  });
+  assert.deepEqual(set, [[7, 50], [404, null]]);
+});
+
+test('an act that throws leaves the decision passed and says it did not run', async () => {
+  await stub(autoDb, { setFenceEnabled: async () => { throw new Error('db down'); } }, async () => {
+    const { out, events } = await closeMatter({ area: 'automation', action: { type: 'switch_on' } });
+    assert.equal(out.outcome, 'passed');
+    assert.deepEqual([out.acted.done, out.acted.reason], [false, 'act_failed']);
+    assert.equal(events.find(([n]) => n === 'board.matter.passed')[1].acted, false);
+  });
+});
+
+test('a stored act that no longer validates is not carried out', async () => {
+  let wrote = false;
+  await stub(autoDb, { allowGoal: async () => { wrote = true; } }, async () => {
+    const { out } = await closeMatter({ area: 'automation', action: { type: 'allow_goal', goal_id: -3 } });
+    assert.deepEqual([out.acted.done, out.acted.reason], [false, 'bad_action']);
+  });
+  assert.equal(wrote, false);
+});
+
+// ── the two desks' server halves ────────────────────────────────────────────
+
+test('Treasury desk: a row per builder, their limit as the fact, the other limits one tap each', () => {
+  const rows = buildersRoute.budgetDeskRows([{ id: 7, display_name: 'Ana', github_login: 'ana', monthly_budget_usd: '100.00' }, { id: 8, github_login: 'kai', monthly_budget_usd: null }]);
+  assert.equal(rows[0].fact, '$100 a month');
+  assert.deepEqual(rows[0].acts[0].options.map((o) => o.key), ['25', '50', '250', 'none']);
+  assert.ok(rows[0].acts[0].options.every((o) => o.label.length <= 16), 'every chip fits the line rule');
+  assert.equal(rows[1].fact, 'no limit');
+  assert.deepEqual(rows[1].acts[0].options.map((o) => o.key), ['25', '50', '100', '250']);
+  assert.deepEqual(rows[0].ref, { type: 'builder_budget', id: 7 });
+});
+
+test('Review desk: only signed-off promises, newest first, each undone with a one-tap reason', () => {
+  const rows = lifeDocket.signedDeskRows([
+    { id: 1, criterion_md: 'Old', satisfied: true, checked_at: '2026-09-01T00:00:00Z' },
+    { id: 2, criterion_md: 'New', satisfied: true, checked_at: '2026-10-02T00:00:00Z' },
+    { id: 3, criterion_md: 'Open', satisfied: false, checked_at: null },
+  ]);
+  assert.deepEqual(rows.map((r) => r.name), ['New', 'Old']);
+  assert.equal(rows[0].acts[0].key, 'unsign');
+  assert.ok(rows[0].acts[0].options.every((o) => o.label.length <= 16));
+});
+
+test('the desks are read under their routes\' own atoms, and the budget route is pinned', () => {
+  const desks = api.contributions('governor.docket').filter((c) => c && (c.desk === 'treasury.budgets' || c.desk === 'review.signed'));
+  const gates = Object.fromEntries(desks.map((c) => [c.desk, c.gate && c.gate.permission]));
+  assert.equal(gates['treasury.budgets'], 'builder.budget.set');
+  assert.equal(rrc.EXPECTED_RANKS['PATCH /builders/:id/budget'], 'perm:builder.budget.set');
+  const life = rrc.MODULE_EXPECTED_RANKS.lifecycle || Object.values(rrc.MODULE_EXPECTED_RANKS).find((m) => m['POST /done-when/:criterionId/unsatisfy']);
+  assert.equal(life['POST /done-when/:criterionId/unsatisfy'], 'perm:criterion.unsatisfy');
+});